GHSA-pj7x-6wpf-pgvp: SQL Injection

Q: Which deployments are exposed to this issue?

Deployments using @payloadcms/db-sqlite or @payloadcms/db-d1-sqlite are affected when a readable collection contains a json field or a blocks field configured with blocksAsJSON: true. Deployments using @payloadcms/db-postgres or @payloadcms/db-vercel-postgres are affected under the same field conditions if they are below 3.73.0.

Q: What access does an attacker need?

An attacker needs both read access and create or update access to the affected collection. The injection requires a request targeting a specific field-path shape and operators.

Q: Are rich text fields affected?

No. RichText fields are explicitly not affected; exposure depends on json fields or blocks fields with blocksAsJSON: true.

Q: What should be done if the affected field types are in use?

Upgrade Payload packages to version 3.90.0 or later, or 4.0.0-canary.34 or later. The patched versions sanitize query input to prevent the injection.

Published Oct 7, 2026

Updated

Impact

An attacker who has read plus create or update access to a collection can submit a request that includes a SQL injection targeting a specific field path shape and operators in Payload's SQLite and Postgres.

You are affected if:

- You use @payloadcms/db-sqlite or @payloadcms/db-d1-sqlite. - You use @payloadcms/db-postgres or @payloadcms/db-vercel-postgres < 3.73.0. - A readable collection has a json field, or a blocks field with blocksAsJSON: true. - The attacker has read plus create or update access on it.

You are not affected if: - You have no json or blocksAsJSON fields. richText is not affected. - You run a patched version.

Patches

The patched version sanitizes the query input to prevent injection.

Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.

Affected Software

6 affected componentsFixes available

npm/@payloadcms/db-d1-sqlite>=4.0.0-canary.0<4.0.0-canary.34

4.0.0-canary.34

npm/@payloadcms/db-sqlite>=4.0.0-canary.0<4.0.0-canary.34

4.0.0-canary.34

npm/@payloadcms/db-vercel-postgres>=3.0.0<3.73.0

3.73.0

npm/@payloadcms/db-postgres>=3.0.0<3.73.0

3.73.0

npm/@payloadcms/db-d1-sqlite>=3.0.0<3.90.0

3.90.0

npm/@payloadcms/db-sqlite>=3.0.0<3.90.0

3.90.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade npm/@payloadcms/db-d1-sqlite to a version that resolves this vulnerability.
Fixed in 4.0.0-canary.34
Upgrade
Upgrade npm/@payloadcms/db-sqlite to a version that resolves this vulnerability.
Fixed in 4.0.0-canary.34
Upgrade
Upgrade npm/@payloadcms/db-vercel-postgres to a version that resolves this vulnerability.
Fixed in 3.73.0
Upgrade
Upgrade npm/@payloadcms/db-postgres to a version that resolves this vulnerability.
Fixed in 3.73.0
Upgrade
Upgrade npm/@payloadcms/db-d1-sqlite to a version that resolves this vulnerability.
Fixed in 3.90.0
Upgrade
Upgrade npm/@payloadcms/db-sqlite to a version that resolves this vulnerability.
Fixed in 3.90.0
Upgrade
Upgrade Payload packages to a version that resolves this vulnerability.
Fixed in 3.90.0

Event History

Oct 7, 2026

Advisory Published

via GitHub·08:30 PM

Data Sourced

via GitHub·08:30 PM

DescriptionWeaknessAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using @payloadcms/db-sqlite or @payloadcms/db-d1-sqlite are affected when a readable collection contains a json field or a blocks field configured with blocksAsJSON: true. Deployments using @payloadcms/db-postgres or @payloadcms/db-vercel-postgres are affected under the same field conditions if they are below 3.73.0.

What access does an attacker need?

An attacker needs both read access and create or update access to the affected collection. The injection requires a request targeting a specific field-path shape and operators.

Are rich text fields affected?

No. RichText fields are explicitly not affected; exposure depends on json fields or blocks fields with blocksAsJSON: true.

What should be done if the affected field types are in use?

Upgrade Payload packages to version 3.90.0 or later, or 4.0.0-canary.34 or later. The patched versions sanitize query input to prevent the injection.

GHSA-pj7x-6wpf-pgvp: SQL Injection

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What access does an attacker need?

Are rich text fields affected?

What should be done if the affected field types are in use?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What access does an attacker need?

Are rich text fields affected?

What should be done if the affected field types are in use?